@monster-orange/den 0.4.19 → 0.4.21

package/src/ui/server/index.ts

@@ -173,6 +173,7 @@ import {
 } from "../../shared/auth/sudo-vault.js";
 import {
   notConfiguredMessage,
+  opTokenSourceSetting,
   secretsConfigWarnings,
 } from "../../shared/secrets/index.js";
 import { DEN_BANNER_LINES, DEN_SUBTITLE } from "../../shared/banner.js";
@@ -228,7 +229,7 @@ import {
   ignoredConfigWarning,
   localhostOrigin,
   loginLink,
-  LOGIN_CODE_TTL_MS,
+  LOGIN_CODE_MAX_TTL_MS,
   mintLoginCode,
   readWebAuthConfig,
   safeNext,
@@ -242,6 +243,14 @@ import {
 import { serveUiAsset } from "./ui-assets.js";
 import { PERSON_GRANT_ROUTES, personGrantAllowed } from "./approvals.js";
 import { ClaimNonces, checkClaimCode } from "../../shared/claim-code.js";
+import {
+  ATTEST_NONCES_FILE,
+  attestRedirect,
+  attestReturn,
+  checkAttestCode,
+  mintAttestCode,
+} from "../../shared/attest-code.js";
+import type { ClaimRules } from "./github-routes.js";
 import {
   expiringTokenWarning,
   githubClientId,
@@ -251,6 +260,7 @@ import {
 } from "../../shared/github-app.js";
 import { githubDeviceClient } from "../../shared/github-device.js";
 import { readWebOwner } from "../../shared/web-owner.js";
+import { noRuleMessage, unclaimedSigninReason } from "./github-routes.js";
 import { DeviceFlows } from "./device-flows.js";
 import {
   decideFlow,
@@ -896,7 +906,7 @@ import {
   edgeExposedMessage,
   edgeExposure,
   edgeNetworkSubnets,
-} from "./edge-exposure.js";
+} from "../../shared/edge/exposure.js";
 import { initLoginPath } from "../../shared/agents/runtime-search.js";
 import {
   linksFor,
@@ -1052,6 +1062,89 @@ const WEB_AUTH: WebAuthConfig = (() => {
   }
 })();
 
+/** web's sign-in config read now (Settings may change it), else at start. */
+function webAuthNow(): WebAuthConfig {
+  try {
+    return readWebAuthConfig(getDistRoot(), product().configFile);
+  } catch {
+    return WEB_AUTH;
+  }
+}
+
+/** D17: who may claim this Den while it has no owner (read now). */
+function claimRulesNow(): ClaimRules {
+  const w = webAuthNow();
+  return {
+    ...(w.ownerGithub ? { ownerGithub: w.ownerGithub } : {}),
+    ...(w.allowedGithubOrg ? { allowedGithubOrg: w.allowedGithubOrg } : {}),
+    // Where it is, or would go: the distribution config.
+    allowedGithubOrgFile: w.allowedGithubOrgFile ?? product().configFile,
+  };
+}
+
+/** D17: the spent "This is my computer" codes (attest-code.ts). */
+const ATTEST_NONCES = new ClaimNonces(getStateDir(), ATTEST_NONCES_FILE);
+
+/** The request's Host without its port, lowercase. */
+function hostNameOf(req: http.IncomingMessage): string {
+  return String(req.headers.host ?? "")
+    .toLowerCase()
+    .replace(/:\d+$/, "");
+}
+
+/**
+ * D17: spend an attest code for this request's host: one of this server's
+ * edge hostnames, the code minted for it, unused. True once.
+ */
+function spendAttest(req: http.IncomingMessage, code: string): boolean {
+  const secret = webSecret.current();
+  const host = hostNameOf(req);
+  if (!secret || !denEdgeHosts().includes(host)) return false;
+  const c = checkAttestCode(code, secret, host);
+  return c.ok && ATTEST_NONCES.consume(c.nonce, c.expiresAt);
+}
+
+/**
+ * `GET /attest?return=<edge URL>` (D17, fix A): only on localhost (only a
+ * browser on this machine reaches it there). A 303 back to `return`, one of
+ * this server's own edge hosts, with a short-lived code in the fragment.
+ * Anything else: an error page, and no code.
+ */
+function handleAttest(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  url: URL,
+  guard: GuardResult,
+  requestId: string,
+): void {
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  const refuse = (status: 400 | 403, message: string) =>
+    sendErrorPage(req, res, {
+      status,
+      path: "/attest",
+      message,
+      code: status === 403 ? "not_this_computer" : "bad_return",
+      requestId,
+    });
+  if (!guard.ok || guard.via !== "loopback" || guard.beyond)
+    return refuse(
+      403,
+      "This works only on the computer this Den runs on, at localhost.",
+    );
+  const ret = attestReturn(url.searchParams.get("return"), denEdgeHosts());
+  const secret = webSecret.current();
+  if (!ret || !secret)
+    return refuse(
+      400,
+      "That address isn't one of this Den's own. Open this Den at its own address and try again.",
+    );
+  res.writeHead(303, {
+    Location: attestRedirect(ret, mintAttestCode(secret, ret.host)),
+  });
+  res.end();
+}
+
 /**
  * The loopback names, with the port: localhost (canonical), 127.0.0.1 and
  * [::1]; the product's own name when /etc/hosts maps it to 127.0.0.1 (the
@@ -1197,7 +1290,11 @@ const GITHUB = githubEndpoints();
 const DEVICE_FLOWS = new DeviceFlows({
   client: githubDeviceClient(GITHUB),
   clientId: () => GITHUB_CLIENT_ID,
-  decide: decideFlow(getStateDir, (l) => serverLog(l, "lifecycle")),
+  decide: decideFlow(
+    getStateDir,
+    (l) => serverLog(l, "lifecycle"),
+    () => claimRulesNow(),
+  ),
   // A test's fake GitHub may answer interval 0; the real one never does.
   minIntervalMs: GITHUB.fake ? 50 : 1000,
   onExpiringToken: noteExpiringToken,
@@ -1360,16 +1457,36 @@ function denEdgeRoutes(): { host: string; url: string }[] {
  */
 function githubSignin():
   | { state: "no_client_id" | "no_owner" }
-  | { state: "ready"; ownerLogin: string } {
+  | { state: "ready"; ownerLogin: string }
+  | {
+      state: "claim";
+      org?: string;
+      ownerGithub?: string;
+      /** "This is my computer"'s start, on localhost (fix A). */
+      attest?: string;
+      message: string;
+    } {
   if (!GITHUB_CLIENT_ID) return { state: "no_client_id" };
   const owner = readWebOwner(getStateDir());
-  return owner
-    ? { state: "ready", ownerLogin: owner.login }
-    : { state: "no_owner" };
+  if (owner) return { state: "ready", ownerLogin: owner.login };
+  // D17: no owner yet: who may claim it, and how.
+  const r = claimRulesNow();
+  if (!r.allowedGithubOrg && !r.ownerGithub) return { state: "no_owner" };
+  return {
+    state: "claim",
+    ...(r.allowedGithubOrg
+      ? {
+          org: r.allowedGithubOrg,
+          attest: `${localhostOrigin(PORT)}/attest`,
+        }
+      : {}),
+    ...(r.ownerGithub ? { ownerGithub: r.ownerGithub } : {}),
+    message: unclaimedSigninReason(null, r),
+  };
 }
 
 /**
- * 0.4.3: why the edge is reachable beyond this machine (edge-exposure.ts),
+ * 0.4.3: why the edge is reachable beyond this machine (shared/edge/exposure.ts),
  * once at start; null until known, or when Den can't tell.
  */
 let EDGE_EXPOSED: string | null = null;
@@ -1486,7 +1603,16 @@ function sendSignedOut(
         ...(gh.state === "ready" ? { ownerLogin: gh.ownerLogin } : {}),
         learnMore: GITHUB_SIGNIN_DOCS,
         ...(GITHUB_CLIENT_ID
-          ? {}
+          ? gh.state === "no_owner"
+            ? { message: noRuleMessage(claimRulesNow()) }
+            : gh.state === "claim"
+              ? {
+                  message: gh.message,
+                  ...(gh.org ? { org: gh.org } : {}),
+                  ...(gh.ownerGithub ? { ownerGithub: gh.ownerGithub } : {}),
+                  ...(gh.attest ? { attest: gh.attest } : {}),
+                }
+              : {}
           : { message: noClientIdMessage(product().cli) }),
       },
       ...(opts.expired ? { expired: true } : {}),
@@ -1921,6 +2047,9 @@ async function handleRequest(
     (req.method === "GET" || req.method === "HEAD" || req.method === "POST")
   )
     return handleAuth(req, res, url, requestId);
+  // D17: "This is my computer" (fix A), on localhost only.
+  if (pathname === "/attest" && (req.method === "GET" || req.method === "HEAD"))
+    return handleAttest(req, res, url, guard, requestId);
   // SEC-2a: `web login` registers its link's wait, then polls it
   // (shell-grade: the CLI's bearer).
   if (pathname === "/api/web/logins" && req.method === "POST") {
@@ -1934,7 +2063,7 @@ async function handleRequest(
     const id =
       Number.isFinite(exp) &&
       exp > Date.now() &&
-      exp - Date.now() <= LOGIN_CODE_TTL_MS + 5_000
+      exp - Date.now() <= LOGIN_CODE_MAX_TTL_MS + 5_000
         ? LOGIN_WAITS.register(
             String(body.nonce ?? ""),
             String(body.code ?? ""),
@@ -2043,13 +2172,16 @@ async function handleRequest(
         const secret = webSecret.current();
         if (!secret) return null;
         const now = Date.now();
+        const ttl = webAuthNow().loginLinkTtlMs;
         return {
-          url: loginLink(origin, mintLoginCode(secret, now)),
-          expiresAt: now + LOGIN_CODE_TTL_MS,
+          url: loginLink(origin, mintLoginCode(secret, now, ttl)),
+          expiresAt: now + ttl,
         };
       },
       log: (l) => serverLog(l, "lifecycle"),
       stateDir: getStateDir,
+      claimRules: claimRulesNow,
+      spendAttest,
     }))
   )
     return;
@@ -4860,7 +4992,8 @@ async function handleRequest(
   // ── API: user settings ────────────────────────────────────────────────────
   // GET  /api/settings  → { editor, editors, terminal, terminals, editor_overrides, languages,
   //                         log_window_lines, graph, appearance, shell, distribution,
-  //                         user_web_port, local_dev, cli_tabs, language, ui_languages }
+  //                         user_web_port, local_dev, cli_tabs, language, ui_languages,
+  //                         op_token_source }
   // POST /api/settings  body: { editor?, terminal?, editor_overrides?, graph?, appearance?, shell?,
   //                             language? }
   //   graph: { direction, group, density, panelWidth } (see graph-prefs.ts)
@@ -4929,6 +5062,8 @@ async function handleRequest(
         // what it is when unset (the short hostname).
         machine_name: machineNameSetting(user),
         machine_name_default: machineLabel(null, os.hostname()),
+        // Where the 1Password token comes from (the source, never the token).
+        op_token_source: opTokenSourceSetting(),
       });
     }
     if (req.method === "POST") {

package/src/ui/server/public/error-page.js

@@ -268,7 +268,8 @@ export function landingAfterSignIn(loc) {
  */
 function githubBlock(s, t) {
   const g = s.github;
-  if (!g || s.localhost || g.state === "no_client_id") return "";
+  if (!g || s.localhost || g.state === "no_client_id" || g.state === "claim")
+    return "";
   const host = s.machine || "";
   const ready = g.state === "ready";
   const step1 = withHost(t, "err.signin.ghStep1", {
@@ -291,6 +292,9 @@ function githubBlock(s, t) {
         `<button type="button" class="btn primary" id="den-gh-start">${esc(t("err.signin.github"))}</button>` +
         `</div><div id="den-gh-flow" aria-live="polite"></div>`
       : "") +
+    (!ready && g.message
+      ? `<p class="den-gh-note" id="den-gh-norule">${esc(g.message)}</p>`
+      : "") +
     `<p class="den-gh-note" id="den-gh-only">${esc(t("err.signin.ghOnly"))}` +
     (g.learnMore
       ? ` <a id="den-gh-learn" href="${esc(g.learnMore)}" target="_blank" rel="noopener noreferrer">${esc(t("err.signin.ghLearn"))}</a>`
@@ -299,6 +303,57 @@ function githubBlock(s, t) {
   );
 }
 
+/**
+ * D17: a Den with no owner yet that a rule lets someone claim. It leads the
+ * page: Connect your GitHub account. "This is my computer" (with
+ * web.allowed_github_org) goes to localhost and back, which only works in a
+ * browser on the machine Den runs on, then starts the GitHub sign-in with
+ * that proof; "Sign in as @login" (web.owner_github) works from anywhere.
+ */
+function claimBlock(s, t) {
+  const g = s.github;
+  if (!g || g.state !== "claim" || s.localhost) return "";
+  const host = s.machine || "";
+  const back = location.origin + location.pathname + location.search;
+  const here = g.attest ? `${g.attest}?return=${encodeURIComponent(back)}` : "";
+  return (
+    `<div id="den-gh" class="den-claim">` +
+    `<h2 class="den-h" id="den-claim-title">${esc(t("err.signin.claimTitle"))}</h2>` +
+    `<p class="lead" id="den-claim-lead">${esc(t("err.signin.claimLead", { name: s.name || "Den" }))}</p>` +
+    (g.org
+      ? `<p id="den-claim-org">${withHost(t, "err.signin.claimOrg", { org: g.org, host })}</p>`
+      : "") +
+    `<div class="acts" style="margin-top:0">` +
+    (here
+      ? `<a class="btn primary" id="den-claim-here" href="${esc(here)}">${esc(t("err.signin.claimHere"))}</a>`
+      : "") +
+    (g.ownerGithub
+      ? `<button type="button" class="btn${here ? "" : " primary"}" id="den-gh-start">${esc(t("err.signin.claimAs", { login: g.ownerGithub }))}</button>`
+      : "") +
+    `</div><div id="den-gh-flow" aria-live="polite"></div>` +
+    (here
+      ? `<p class="den-gh-note" id="den-claim-note">${withHost(t, "err.signin.claimHereNote", { host })}</p>`
+      : "") +
+    `</div>`
+  );
+}
+
+/** D17: the "This is my computer" code /attest put in the fragment, taken once. */
+export function takeAttestCode(loc = location, hist = history) {
+  const m = /(?:^#|&)den-attest=([^&]+)/.exec(loc.hash || "");
+  if (!m) return "";
+  try {
+    hist.replaceState(null, "", loc.pathname + loc.search);
+  } catch {
+    /* the address keeps it; it is single use anyway */
+  }
+  try {
+    return decodeURIComponent(m[1]);
+  } catch {
+    return "";
+  }
+}
+
 /** How often, and how long, the page watches for an owner (SEC-2a-UX). */
 export const OWNER_POLL_MS = 5000;
 const OWNER_WATCH_MS = 30 * 60 * 1000;
@@ -332,17 +387,23 @@ function watchOwner(root, t, s, pollMs = OWNER_POLL_MS) {
   setTimeout(tick, pollMs);
 }
 
-/** The device flow on the page: start, show the code, poll, go on. */
-function wireGithub(root, t, s) {
+/**
+ * The device flow on the page: start, show the code, poll, go on. D17: with
+ * `attest` (the code "This is my computer" brought back), it starts at once
+ * with that proof.
+ */
+function wireGithub(root, t, s, attest = "") {
   const start = root.querySelector("#den-gh-start");
   const box = root.querySelector("#den-gh-flow");
-  if (!start || !box) return;
+  if (!box || (!start && !attest)) return;
   let timer = null;
   const show = (html) => (box.innerHTML = html);
   const fail = (text) => {
     clearTimeout(timer);
-    start.hidden = false;
-    start.textContent = t("err.signin.githubAgain");
+    if (start) {
+      start.hidden = false;
+      start.textContent = t("err.signin.githubAgain");
+    }
     show(
       `<p class="den-gh-err" role="alert" style="margin-top:12px">${esc(text)}</p>`,
     );
@@ -367,29 +428,31 @@ function wireGithub(root, t, s) {
           return;
         }
         fail(
-          b.state === "refused"
-            ? t("err.signin.githubRefused", {
-                login: b.login ?? "",
-                name: s.name,
-              })
-            : b.state === "expired"
-              ? t("err.signin.githubExpired")
-              : b.state === "denied"
-                ? t("err.signin.githubDenied")
-                : t("err.signin.githubFailed"),
+          b.state === "refused" && b.error
+            ? b.error
+            : b.state === "refused"
+              ? t("err.signin.githubRefused", {
+                  login: b.login ?? "",
+                  name: s.name,
+                })
+              : b.state === "expired"
+                ? t("err.signin.githubExpired")
+                : b.state === "denied"
+                  ? t("err.signin.githubDenied")
+                  : t("err.signin.githubFailed"),
         );
       })
       .catch(() => fail(t("err.signin.githubFailed")));
   };
-  start.addEventListener("click", () => {
+  const begin = (body) => {
     clearTimeout(timer);
-    start.disabled = true;
+    if (start) start.disabled = true;
     fetch("/api/github/signin", {
       method: "POST",
       cache: "no-store",
       credentials: "same-origin",
       headers: { "Content-Type": "application/json" },
-      body: "{}",
+      body: JSON.stringify(body),
     })
       .then((r) =>
         r
@@ -398,7 +461,7 @@ function wireGithub(root, t, s) {
           .then((b) => [r.status, b]),
       )
       .then(([status, b]) => {
-        start.disabled = false;
+        if (start) start.disabled = false;
         if (!b.ok || !b.userCode) {
           fail(
             status === 429
@@ -407,7 +470,11 @@ function wireGithub(root, t, s) {
           );
           return;
         }
-        start.hidden = true;
+        if (start) start.hidden = true;
+        const here = root.querySelector("#den-claim-here");
+        if (here) here.style.display = "none";
+        const note = root.querySelector("#den-claim-note");
+        if (note) note.style.display = "none";
         const url = b.verificationUri || "https://github.com/login/device";
         const shown = url.replace(/^https:\/\//, "");
         show(
@@ -417,21 +484,30 @@ function wireGithub(root, t, s) {
               url: `<a href="${esc(url)}" target="_blank" rel="noopener noreferrer">${esc(shown)}</a>`,
             },
           )}</p>` +
-            `<pre class="code" id="den-gh-code" style="font-size:22px;letter-spacing:0.12em;text-align:center">${esc(b.userCode)}</pre>` +
+            // The code and its copy button on one line, as every command.
+            cmdLine("den-gh-code", b.userCode, t).replace(
+              'class="den-cmd"',
+              'class="den-cmd den-gh-coderow"',
+            ) +
             `<div class="acts" style="margin-top:0">` +
-            `<a class="btn primary" id="den-gh-open" href="${esc(url)}" target="_blank" rel="noopener noreferrer">${esc(t("err.signin.githubOpen"))}</a>` +
-            `<button type="button" class="btn" id="den-gh-copy">${esc(t("err.signin.githubCopy"))}</button></div>` +
+            `<a class="btn primary" id="den-gh-open" href="${esc(url)}" target="_blank" rel="noopener noreferrer">${esc(t("err.signin.githubOpen"))}</a></div>` +
             `<p class="den-gh-wait" style="margin-top:12px">${esc(t("err.signin.githubWaiting"))}</p>`,
         );
-        const cp = box.querySelector("#den-gh-copy");
-        cp?.addEventListener("click", () => copy(b.userCode, cp, t));
+        wireCopy(box, t);
         timer = setTimeout(() => poll(b.id), 1500);
       })
       .catch(() => {
-        start.disabled = false;
+        if (start) start.disabled = false;
         fail(t("err.signin.githubFailed"));
       });
-  });
+  };
+  start?.addEventListener("click", () => begin({}));
+  if (attest) {
+    show(
+      `<p class="den-gh-wait" style="margin-top:12px">${esc(t("err.signin.claimChecking", { host: s.machine || "" }))}</p>`,
+    );
+    begin({ attest });
+  }
 }
 
 /**
@@ -604,6 +680,8 @@ function mountSignedOut(root, sh, d) {
     `<div class="sub">${esc(t("err.signin.sub"))}</div></div></div>`;
   if (s.confirm) {
     // SEC-2a: a link `web login` waits on: the code it printed, first.
+    // D17: a plain sign-in page, no shell frame and no error wording.
+    document.body.classList.add("den-plain");
     root.innerHTML =
       `<div class="ph"><div><h1>${esc(t("err.signin.title", { name }))}</h1>` +
       `<div class="sub">${esc(t("err.signin.sub"))}</div></div></div>` +
@@ -617,7 +695,6 @@ function mountSignedOut(root, sh, d) {
       `<p class="den-confirm-err" id="den-confirm-err" role="alert" style="margin-top:12px"></p>` +
       `</form>` +
       `<p class="den-signin-why">${withHost(t, "err.signin.confirmWhy", { host })}</p>` +
-      facts +
       `</div>`;
     const form = root.querySelector("#den-confirm");
     const input = root.querySelector("#den-confirm-code");
@@ -672,15 +749,20 @@ function mountSignedOut(root, sh, d) {
       `<div class="acts"><a class="btn primary" id="den-signin-local" href="${esc(s.localhost)}">${esc(t("err.421.open"))}</a></div></div>`;
     return;
   }
-  const gh = githubBlock(s, t);
+  const claim = claimBlock(s, t);
+  const gh = claim || githubBlock(s, t);
   root.innerHTML =
     head +
     `<div class="empty" id="den-signin">` +
     (s.expired
       ? `<p class="lead" role="alert">${esc(t("err.signin.expiredLead"))}</p>`
       : "") +
-    `<p class="lead" id="den-signin-where">${withHost(t, "err.signin.where", { name, host })}</p>` +
-    gh +
+    claim +
+    // D17: with the claim first, "from another computer" may not be true.
+    (claim
+      ? ""
+      : `<p class="lead" id="den-signin-where">${withHost(t, "err.signin.where", { name, host })}</p>`) +
+    (claim ? "" : gh) +
     `<h2 class="den-h" id="den-pair-title">${esc(t(gh ? "err.signin.approveOr" : "err.signin.approve"))}</h2>` +
     `<div id="den-pair" aria-live="polite"></div>` +
     `<p class="den-signin-why"><b>${esc(t("err.signin.whyTitle"))}</b> ${withHost(t, "err.signin.whyText", { name, host })}</p>` +
@@ -695,7 +777,7 @@ function mountSignedOut(root, sh, d) {
     facts +
     `</div>`;
   wireCopy(root, t);
-  wireGithub(root, t, s);
+  wireGithub(root, t, s, claim ? takeAttestCode() : "");
   watchOwner(root, t, s, window.__denOwnerPollMs || OWNER_POLL_MS);
   wirePair(root, t, s);
   if (s.expired) return;

package/src/ui/server/public/error.html

@@ -48,6 +48,16 @@
         flex-direction: column;
         overflow: hidden;
       }
+      /* D17: the /auth code page is a plain sign-in page: no shell frame
+         around it, the form in the middle. */
+      html body.den-plain > :not(#den-content):not(script):not(style) {
+        display: none !important;
+      }
+      html body.den-plain > #den-content {
+        max-width: 560px;
+        margin: 10vh auto 0;
+        width: 100%;
+      }
       /* .main */
       html body.den-has-shell > #den-content {
         overflow: auto;
@@ -234,6 +244,12 @@
         white-space: pre-wrap;
         overflow-wrap: anywhere;
       }
+      /* The GitHub code (D17): big, centred, its copy button beside it. */
+      .den-gh-coderow pre.code {
+        font-size: 22px;
+        letter-spacing: 0.12em;
+        text-align: center;
+      }
       .btn.den-copy {
         padding: 6px 8px;
         align-self: stretch;

package/src/ui/server/public/header.js

@@ -686,7 +686,7 @@ export async function initChangelog() {
 
 // ── __DEN_TITLE__ config ──────────────────────────────────────────────────────────────
 
-let ___DEN_CLI__Config = null;
+let _cliConfig = null;
 
 /**
  * 0.4.1: true once the shell knows the config fails validation (shell.js
@@ -705,18 +705,16 @@ function apiOff() {
 }
 
 async function getDenConfig() {
-  if (___DEN_CLI__Config) return ___DEN_CLI__Config;
+  if (_cliConfig) return _cliConfig;
   if (configInvalid()) return { environments: ["local"] };
   try {
-    ___DEN_CLI__Config = await fetch("/api/__DEN_CLI__/config").then((r) =>
-      r.json(),
-    );
+    _cliConfig = await fetch("/api/__DEN_CLI__/config").then((r) => r.json());
   } catch {
-    ___DEN_CLI__Config = {
+    _cliConfig = {
       environments: ["local"],
     };
   }
-  return ___DEN_CLI__Config;
+  return _cliConfig;
 }
 
 /**

package/src/ui/server/public/i18n/es.js

@@ -305,6 +305,16 @@
     "err.signin.ghOnly":
       "Solo la cuenta de GitHub del propietario puede iniciar sesión así. Para cualquier otra persona, usa «Aprueba este ordenador».",
     "err.signin.ghLearn": "Más información",
+    "err.signin.claimTitle": "Conecta tu cuenta de GitHub",
+    "err.signin.claimLead":
+      "{name} aún no tiene propietario. Conecta tu cuenta de GitHub para que sea tuyo.",
+    "err.signin.claimOrg":
+      "Los miembros de la organización {org} de GitHub pueden reclamarlo, en un navegador en {host}.",
+    "err.signin.claimHere": "Este es mi ordenador: conectar GitHub",
+    "err.signin.claimAs": "Iniciar sesión como @{login}",
+    "err.signin.claimHereNote":
+      "«Este es mi ordenador» solo funciona en un navegador en {host}. En otro sitio no abre nada.",
+    "err.signin.claimChecking": "Comprobando que esto es {host}…",
     "err.signin.githubRefused":
       "@{login} no es el propietario de este {name}. Solo la cuenta del propietario puede usar Iniciar sesión con GitHub. Usa «Aprueba este ordenador» en su lugar.",
     "err.signin.approveOr": "O aprueba este ordenador",
@@ -354,7 +364,6 @@
     "err.signin.github": "Iniciar sesión con GitHub",
     "err.signin.githubEnter": "Introduce este código en {url}:",
     "err.signin.githubOpen": "Abrir GitHub",
-    "err.signin.githubCopy": "Copiar código",
     "err.signin.githubWaiting": "Esperando a que lo apruebes en GitHub…",
     "err.signin.githubDone": "Sesión iniciada. Cargando…",
     "err.signin.githubExpired": "El código caducó antes de aprobarse.",
@@ -402,6 +411,7 @@
     "set.cli.web_port": "Tu puerto web",
     "set.cli.signin": "Inicio de sesión del navegador",
     "set.cli.sudo": "Contraseña de administrador",
+    "set.cli.op_token": "Origen del token de 1Password",
     "set.access.owner": "Propietario",
     "set.access.devices": "Dispositivos vinculados",
     "set.access.waiting": "Dispositivos en espera",

package/src/ui/server/public/i18n/ja.js

@@ -293,6 +293,16 @@
     "err.signin.ghOnly":
       "この方法でサインインできるのはオーナーの GitHub アカウントだけです。それ以外の人は「このコンピューターを承認」を使ってください。",
     "err.signin.ghLearn": "詳しく見る",
+    "err.signin.claimTitle": "GitHub アカウントを接続",
+    "err.signin.claimLead":
+      "{name} にはまだオーナーがいません。GitHub アカウントを接続して、自分のものにします。",
+    "err.signin.claimOrg":
+      "GitHub の {org} 組織のメンバーは、{host} 上のブラウザーでこれを登録できます。",
+    "err.signin.claimHere": "これは自分のコンピューター: GitHub を接続",
+    "err.signin.claimAs": "@{login} としてサインイン",
+    "err.signin.claimHereNote":
+      "「これは自分のコンピューター」は {host} 上のブラウザーでだけ使えます。ほかの場所では何も開きません。",
+    "err.signin.claimChecking": "ここが {host} か確認しています…",
     "err.signin.githubRefused":
       "@{login} はこの {name} のオーナーではありません。GitHub でサインインを使えるのはオーナーのアカウントだけです。代わりに「このコンピューターを承認」を使ってください。",
     "err.signin.approveOr": "または、このコンピューターを承認",
@@ -343,7 +353,6 @@
     "err.signin.github": "GitHub でサインイン",
     "err.signin.githubEnter": "{url} でこのコードを入力してください:",
     "err.signin.githubOpen": "GitHub を開く",
-    "err.signin.githubCopy": "コードをコピー",
     "err.signin.githubWaiting": "GitHub での承認を待っています…",
     "err.signin.githubDone": "サインインしました。読み込み中…",
     "err.signin.githubExpired": "承認される前にコードの有効期限が切れました。",
@@ -391,6 +400,7 @@
     "set.cli.web_port": "あなたの web ポート",
     "set.cli.signin": "ブラウザのサインイン",
     "set.cli.sudo": "管理者パスワード",
+    "set.cli.op_token": "1Password トークンの取得元",
     "set.access.owner": "オーナー",
     "set.access.devices": "リンク済みデバイス",
     "set.access.waiting": "承認待ちのデバイス",